+ userfaultfd-introduce-struct-mfill_state-fix.patch added to mm-unstable branch

+ userfaultfd-introduce-struct-mfill_state-fix.patch added to mm-unstable branch

[Andrew Morton]

The patch titled
     Subject: userfaultfd-introduce-struct-mfill_state-fix
has been added to the -mm mm-unstable branch.  Its filename is
     userfaultfd-introduce-struct-mfill_state-fix.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-introduce-struct-mfill_state-fix.patch

This patch will later appear in the mm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Harry Yoo <harry.yoo@oracle.com>
Subject: userfaultfd-introduce-struct-mfill_state-fix
Date: Mon, 16 Mar 2026 15:19:49 +0900

fix folio_add_new_anon_rmap() WARN

Link: https://lkml.kernel.org/r/abehBY7QakYF9bK4@hyeyoo
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Reported-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reported-by: syzbot+e24a2e34fad0efbac047@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/69b703e6.050a0220.248e02.0101.GAE@google.com
Cc: Mike Rapoport <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/userfaultfd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/userfaultfd.c~userfaultfd-introduce-struct-mfill_state-fix
+++ a/mm/userfaultfd.c
@@ -734,7 +734,7 @@ static __always_inline ssize_t mfill_ato
 		.dst_start = dst_start,
 		.src_start = src_start,
 		.flags = flags,
-
+		.len = len,
 		.src_addr = src_start,
 		.dst_addr = dst_start,
 	};
_

Patches currently in -mm which might be from harry.yoo@oracle.com are

userfaultfd-introduce-struct-mfill_state-fix.patch

+ userfaultfd-introduce-struct-mfill_state-fix.patch added to mm-unstable branch

[Andrew Morton]

The patch titled
     Subject: userfaultfd-introduce-struct-mfill_state-fix
has been added to the -mm mm-unstable branch.  Its filename is
     userfaultfd-introduce-struct-mfill_state-fix.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-introduce-struct-mfill_state-fix.patch

This patch will later appear in the mm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Mike Rapoport <rppt@kernel.org>
Subject: userfaultfd-introduce-struct-mfill_state-fix
Date: Wed, 1 Apr 2026 10:36:03 +0300

fix bisection hole, per Harry

Link: https://lkml.kernel.org/r/aczK4-vrULRiTvyh@kernel.org
Signed-off-by: Mike Rapoport <rppt@kernel.org>
Cc: "Harry Yoo (Oracle)" <harry@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/userfaultfd.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/mm/userfaultfd.c~userfaultfd-introduce-struct-mfill_state-fix
+++ a/mm/userfaultfd.c
@@ -764,6 +764,7 @@ retry:
 		err = PTR_ERR(dst_vma);
 		goto out;
 	}
+	state.vma = dst_vma;
 
 	/*
 	 * If memory mappings are changing because of non-cooperative
@@ -804,8 +805,6 @@ retry:
 	    uffd_flags_mode_is(flags, MFILL_ATOMIC_CONTINUE))
 		goto out_unlock;
 
-	state.vma = dst_vma;
-
 	while (state.src_addr < src_start + len) {
 		VM_WARN_ON_ONCE(state.dst_addr >= dst_start + len);
 
_

Patches currently in -mm which might be from rppt@kernel.org are

userfaultfd-introduce-mfill_copy_folio_locked-helper.patch
userfaultfd-introduce-struct-mfill_state.patch
userfaultfd-introduce-struct-mfill_state-fix.patch
userfaultfd-introduce-mfill_establish_pmd-helper.patch
userfaultfd-introduce-mfill_get_vma-and-mfill_put_vma.patch
userfaultfd-retry-copying-with-locks-dropped-in-mfill_atomic_pte_copy.patch
userfaultfd-move-vma_can_userfault-out-of-line.patch
userfaultfd-introduce-vm_uffd_ops.patch
shmem-userfaultfd-use-a-vma-callback-to-handle-uffdio_continue.patch
userfaultfd-introduce-vm_uffd_ops-alloc_folio.patch
shmem-userfaultfd-implement-shmem-uffd-operations-using-vm_uffd_ops.patch
userfaultfd-mfill_atomic-remove-retry-logic.patch